{"answers":{"affected":"It affects 79 products.","exploited":"There is no known exploitation of CVE-2017-2681 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2017-2681 yet. Limit exposure of the affected software until one is available.","what":"CVE-2017-2681 is a high-severity denial of service vulnerability in Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, published on 11 May 2017. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2017-2681 and fix it if it is affected.\n\nWhat it is: CVE-2017-2681 is a high-severity denial of service vulnerability in Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, published on 11 May 2017. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2017-2681 in the wild and no public exploit code.\n\nAffected product: Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2017-2681/ (Markdown: https://insights.sbomify.com/CVE-2017-2681/index.md)","id":"CVE-2017-2681","markdown":"https://insights.sbomify.com/CVE-2017-2681/index.md","name":"CVE-2017-2681","record":{"aliases":["GHSA-j585-83xv-q5c7"],"analysis":{"component_type":"network_device","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Siemens PROFINET devices","requires_auth":"none","summary":"Crafted PROFINET DCP packets can cause denial of service on Siemens network devices, requiring manual recovery.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"siemens","cpe":[{"product":"dk_standard_ethernet_controller_firmware","vendor":"siemens"},{"product":"ek-ertec_200_pn_io_firmware","vendor":"siemens"},{"product":"ek-ertec_200p_pn_io_firmware","vendor":"siemens"},{"product":"ie\\/as-i_link_pn_io_firmware","vendor":"siemens"},{"product":"ie\\/pb-link_firmware","vendor":"siemens"},{"product":"pn\\/pn_coupler_firmware","vendor":"siemens"},{"product":"scalance_m-800_firmware","vendor":"siemens"},{"product":"scalance_s615_firmware","vendor":"siemens"},{"product":"scalance_w700_firmware","vendor":"siemens"},{"product":"scalance_x200_firmware","vendor":"siemens"},{"product":"scalance_x200_irt_firmware","vendor":"siemens"},{"product":"scalance_x300_firmware","vendor":"siemens"},{"product":"scalance_x408_firmware","vendor":"siemens"},{"product":"scalance_x414_firmware","vendor":"siemens"},{"product":"scalance_xm400_firmware","vendor":"siemens"},{"product":"scalance_xr500_firmware","vendor":"siemens"},{"product":"simatic_cm_1542-1_firmware","vendor":"siemens"},{"product":"simatic_cm_1542sp-1_firmware","vendor":"siemens"},{"product":"simatic_cp_1243-1_dnp3_firmware","vendor":"siemens"},{"product":"simatic_cp_1243-1_firmware","vendor":"siemens"},{"product":"simatic_cp_1243-1_iec_firmware","vendor":"siemens"},{"product":"simatic_cp_1243-1_irc_firmware","vendor":"siemens"},{"product":"simatic_cp_1542sp-1_irc_firmware","vendor":"siemens"},{"product":"simatic_cp_1543-1_firmware","vendor":"siemens"},{"product":"simatic_cp_1543sp-1_firmware","vendor":"siemens"},{"product":"simatic_cp_1604_firmware","vendor":"siemens"},{"product":"simatic_cp_1616_firmware","vendor":"siemens"},{"product":"simatic_cp_343-1_adv_firmware","vendor":"siemens"},{"product":"simatic_cp_343-1_lean_firmware","vendor":"siemens"},{"product":"simatic_cp_343-1_std_firmware","vendor":"siemens"},{"product":"simatic_cp_443-1_adv_firmware","vendor":"siemens"},{"product":"simatic_cp_443-1_opc-ua_firmware","vendor":"siemens"},{"product":"simatic_cp_443-1_std_firmware","vendor":"siemens"},{"product":"simatic_dk-16xx_pn_io_firmware","vendor":"siemens"},{"product":"simatic_et_200al_firmware","vendor":"siemens"},{"product":"simatic_et_200ecopn_firmware","vendor":"siemens"},{"product":"simatic_et_200m_firmware","vendor":"siemens"},{"product":"simatic_et_200mp_firmware","vendor":"siemens"},{"product":"simatic_et_200pro_firmware","vendor":"siemens"},{"product":"simatic_et_200s_firmware","vendor":"siemens"},{"product":"simatic_et_200sp_firmware","vendor":"siemens"},{"product":"simatic_hmi_comfort_panels","vendor":"siemens"},{"product":"simatic_hmi_mobile_panels","vendor":"siemens"},{"product":"simatic_hmi_multi_panels","vendor":"siemens"},{"product":"simatic_rf650r_firmware","vendor":"siemens"},{"product":"simatic_rf680r_firmware","vendor":"siemens"},{"product":"simatic_rf685r_firmware","vendor":"siemens"},{"product":"simatic_s7-1200_firmware","vendor":"siemens"},{"product":"simatic_s7-1500_firmware","vendor":"siemens"},{"product":"simatic_s7-1500_software_controller","vendor":"siemens"},{"product":"simatic_s7-200_smart_firmware","vendor":"siemens"},{"product":"simatic_s7-300_firmware","vendor":"siemens"},{"product":"simatic_s7-400_firmware","vendor":"siemens"},{"product":"simatic_tdc_cp51m1_firmware","vendor":"siemens"},{"product":"simatic_tdc_cpu555_firmware","vendor":"siemens"},{"product":"simatic_teleservice_adapter_ie_advanced_modem_firmware","vendor":"siemens"},{"product":"simatic_teleservice_adapter_ie_basic_modem_firmware","vendor":"siemens"},{"product":"simatic_teleservice_adapter_standard_modem_firmware","vendor":"siemens"},{"product":"simatic_winac_rtx_firmware","vendor":"siemens"},{"product":"simocode_pro_v_profinet_firmware","vendor":"siemens"},{"product":"simotion_firmware","vendor":"siemens"},{"product":"sinamics_dcm_firmware","vendor":"siemens"},{"product":"sinamics_dcp_firmware","vendor":"siemens"},{"product":"sinamics_g110m_firmware","vendor":"siemens"},{"product":"sinamics_g120\\(c\\/p\\/d\\)_pn_firmware","vendor":"siemens"},{"product":"sinamics_g130_firmware","vendor":"siemens"},{"product":"sinamics_g150_firmware","vendor":"siemens"},{"product":"sinamics_s110_pn_firmware","vendor":"siemens"},{"product":"sinamics_s120_firmware","vendor":"siemens"},{"product":"sinamics_s150_firmware","vendor":"siemens"},{"product":"sinamics_v90_pn_firmware","vendor":"siemens"},{"product":"sinumerik_828d_firmware","vendor":"siemens"},{"product":"sinumerik_840d_sl_firmware","vendor":"siemens"},{"product":"sirius_act_3su1_firmware","vendor":"siemens"},{"product":"sirius_motor_starter_m200d_profinet_firmware","vendor":"siemens"},{"product":"sirius_soft_starter_3rw44_pn_firmware","vendor":"siemens"},{"product":"sitop_psu8600_firmware","vendor":"siemens"},{"product":"softnet_profinet_io_firmware","vendor":"siemens"},{"product":"ups1600_profinet_firmware","vendor":"siemens"}],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Denial of service in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller","id":"CVE-2017-2681","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2017"},"n_packages":0,"n_references":5,"next":{"headline":"Cross-site request forgery in RUGGEDCOM NMS All versions \u003c V2.1 (Windows and Linux)","id":"CVE-2017-2682"},"packages":[],"prev":{"headline":"Denial of service in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller","id":"CVE-2017-2680"},"products":["Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller","Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200","Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P","IE/AS-i Link PN IO","IE/PB-Link (incl. SIPLUS NET variants)","SCALANCE M-800 family (incl. S615, MUM-800 and RM1224)","SCALANCE W-700 IEEE 802.11n family","SCALANCE X-200 family (incl. SIPLUS NET variants)","SCALANCE X-200IRT family (incl. SIPLUS NET variants)","SCALANCE X-300 family (incl. X408 and SIPLUS NET variants)","SCALANCE X408 family","SCALANCE X414","SCALANCE XM-400 family","SCALANCE XR-500 family","SIMATIC CM 1542-1","SIMATIC CM 1542SP-1","SIMATIC CP 1243-1 (incl. SIPLUS variants)","SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)","SIMATIC CP 1243-1 IEC (incl. SIPLUS variants)","SIMATIC CP 1243-8 IRC","SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants)","SIMATIC CP 1543-1 (incl. SIPLUS variants)","SIMATIC CP 1543SP-1 (incl. SIPLUS variants)","SIMATIC CP 1604","SIMATIC CP 1616","SIMATIC CP 343-1 (incl. SIPLUS variants)","SIMATIC CP 343-1 Advanced (incl. SIPLUS variants)","SIMATIC CP 343-1 Lean (incl. SIPLUS variants)","SIMATIC CP 443-1 (incl. SIPLUS variants)","SIMATIC CP 443-1 Advanced (incl. SIPLUS variants)","SIMATIC CP 443-1 OPC UA","SIMATIC DK-16xx PN IO","SIMATIC ET 200AL IM 157-1 PN","SIMATIC ET 200M (incl. SIPLUS variants)","SIMATIC ET 200MP IM 155-5 PN BA","SIMATIC ET 200MP IM 155-5 PN HF","SIMATIC ET 200MP IM 155-5 PN ST","SIMATIC ET 200SP IM 155-6 PN BA","SIMATIC ET 200SP IM 155-6 PN HF","SIMATIC ET 200SP IM 155-6 PN HS","SIMATIC ET 200SP IM 155-6 PN ST","SIMATIC ET 200SP IM 155-6 PN ST BA","SIMATIC ET 200pro IM 154-3 PN HF","SIMATIC ET 200pro IM 154-4 PN HF","SIMATIC ET200S (incl. SIPLUS variants)","SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12","SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12","SIMATIC ET200ecoPN, 4AO U/I 4xM12","SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12","SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12","SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12","SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12","SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12","SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12","SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12","SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12","SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12","SIMATIC ET200ecoPN: IO-Link Master","SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels (incl. SIPLUS variants)","SIMATIC MV420 SR-B","SIMATIC MV420 SR-B Body","SIMATIC MV420 SR-P","SIMATIC MV420 SR-P Body","SIMATIC MV440 HR","SIMATIC MV440 SR","SIMATIC MV440 UR","SIMATIC PN/PN Coupler (incl. SIPLUS NET variants)","SIMATIC RF650R","SIMATIC RF680R","SIMATIC RF685R","SIMATIC S7-1200 CPU family (incl. SIPLUS variants)","SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)","SIMATIC S7-1500 Software Controller","SIMATIC S7-200 SMART","SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants)","SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)","SIMATIC S7-400 PN/DP V6 CPU family (incl. SIPLUS variants)","SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)","SIMATIC S7-410 CPU family (incl. SIPLUS variants)","SIMATIC TDC CP51M1","SIMATIC TDC CPU555","SIMATIC Teleservice Adapter IE Advanced","SIMATIC Teleservice Adapter IE Basic","SIMATIC Teleservice Adapter IE Standard","SIMATIC WinAC RTX 2010","SIMATIC WinAC RTX F 2010","SIMOCODE pro V PROFINET (incl. SIPLUS variants)","SIMOTION","SINAMICS DCM w. PN","SINAMICS DCP w. PN","SINAMICS G110M w. PN","SINAMICS G120(C/P/D) w. PN (incl. SIPLUS variants)","SINAMICS G130 V4.7 w. PN","SINAMICS G130 V4.8 w. PN","SINAMICS G150 V4.7 w. PN","SINAMICS G150 V4.8 w. PN","SINAMICS S110 w. PN","SINAMICS S120 V4.7 SP1 w. PN (incl. SIPLUS variants)","SINAMICS S120 V4.7 w. PN (incl. SIPLUS variants)","SINAMICS S120 V4.8 w. PN (incl. SIPLUS variants)","SINAMICS S120 prior to V4.7 w. PN (incl. SIPLUS variants)","SINAMICS S150 V4.7 w. PN","SINAMICS S150 V4.8 w. PN","SINAMICS V90 w. PN","SINUMERIK 828D V4.5 and prior","SINUMERIK 828D V4.7","SINUMERIK 840D sl V4.5 and prior","SINUMERIK 840D sl V4.7","SIPLUS ET 200MP IM 155-5 PN HF","SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL","SIPLUS ET 200MP IM 155-5 PN ST","SIPLUS ET 200MP IM 155-5 PN ST TX RAIL","SIPLUS ET 200SP IM 155-6 PN HF","SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL","SIPLUS ET 200SP IM 155-6 PN ST","SIPLUS ET 200SP IM 155-6 PN ST BA","SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL","SIPLUS ET 200SP IM 155-6 PN ST TX RAIL","SIRIUS ACT 3SU1 interface module PROFINET","SIRIUS Motor Starter M200D PROFINET","SIRIUS Soft Starter 3RW44 PN","SITOP PSU8600 PROFINET","SITOP UPS1600 PROFINET (incl. SIPLUS variants)","Softnet PROFINET IO for PC-based Windows systems"],"published":"2017-05-11","related":[{"cvss_score":8.7,"headline":"Denial of service in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller","id":"CVE-2017-12741","kev_date_added":null,"published":"2017-12-26"},{"cvss_score":7.5,"headline":"Denial of service in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller","id":"CVE-2019-10936","kev_date_added":null,"published":"2019-10-10"},{"cvss_score":7.1,"headline":"Denial of service in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller","id":"CVE-2017-2680","kev_date_added":null,"published":"2017-05-11"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-09-10","vendors":["Siemens"]},"summary":"Crafted PROFINET DCP packets can cause denial of service on Siemens network devices, requiring manual recovery.","url":"https://insights.sbomify.com/CVE-2017-2681/"}